userenv[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
userenv.dll
Size 1.5MB
Sample260626-xdarjsd13s
SHA256 4dad9264d498903d1010438255d6a4507ae7551adb79d469f8b8a4751fb7cef6
MD5 36dab0daae1bafcea825b49c1c634a30
SHA1 1e0deb843e948d564df7cee1e0b7ff12cf65f8be
SHA512 c143388b1f82d5984c677137bee316d0a8d14a13bbdcb05ae47a8e143f1de1b6898f874b41a10a67fc8503050da2071885b0183167f83088dee15bdac0c418ac
SSDEEP 24576:h8Di2DnbPzFRASCYR4iVwaqXc5s8WHbKKF4VqQ9VRQ6IHEviniHI7W:STDzWaqXc5s8W+KFSqX6Zvin
TLSH
T18B755C2EFB4251F4E22397B5854FEB7B8B1879258021EE7FFF4ACA14B4335123845296
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
userenv.dll

File Explorer

userenv.dll

.dll 1.5MB

userenv.dll

IMPHASH 1c30ffe0ba2df22d02f21cb0c2bce16c
SHA256 4dad9264d498903d1010438255d6a4507ae7551adb79d469f8b8a4751fb7cef6
MD5 36dab0daae1bafcea825b49c1c634a30
SHA1 1e0deb843e948d564df7cee1e0b7ff12cf65f8be
SHA512 c143388b1f82d5984c677137bee316d0a8d14a13bbdcb05ae47a8e143f1de1b6898f874b41a10a67fc8503050da2071885b0183167f83088dee15bdac0c418ac
SSDEEP 24576:h8Di2DnbPzFRASCYR4iVwaqXc5s8WHbKKF4VqQ9VRQ6IHEviniHI7W:STDzWaqXc5s8W+KFSqX6Zvin
TLSH
T18B755C2EFB4251F4E22397B5854FEB7B8B1879258021EE7FFF4ACA14B4335123845296
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateMutexA CreateThread DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileA FindNextFileA FormatMessageA FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeThread GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessWorkingSetSize GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetThreadId GetTimeZoneInformation GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter ResumeThread SetConsoleMode SetLastError Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

msvcrt

__mb_cur_max _amsg_exit _errno _fstat64 _initterm _iob _lock _lseeki64 _unlock _wfopen abort atoi calloc exit fclose fflush fopen fputc fputs free fwrite getenv isalpha iswctype localeconv malloc memchr memcmp memcpy memmove memset gmtime realloc setlocale setvbuf strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtol strtoul strxfrm tolower towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm _write _strdup _read _fileno _fdopen

ws2_32

WSACleanup WSAGetLastError WSAPoll WSAStartup closesocket connect freeaddrinfo getaddrinfo getsockopt htons inet_ntop inet_pton ioctlsocket recv recvfrom send sendto socket

AreThereVisibleLogoffScripts AreThereVisibleShutdownScripts CreateAppContainerProfile CreateEnvironmentBlock CreateProfile DeleteAppContainerProfile DeleteProfileA DeleteProfileW DeriveAppContainerSidFromAppContainerName DeriveRestrictedAppContainerSidFromAppContainerSidAndRestrictedName DestroyEnvironmentBlock DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer EnterCriticalPolicySection ExpandEnvironmentStringsForUserA ExpandEnvironmentStringsForUserW ForceSyncFgPolicy FreeGPOListA FreeGPOListW GenerateGPNotification GetAllUsersProfileDirectoryA GetAllUsersProfileDirectoryW GetAppContainerFolderPath GetAppContainerRegistryLocation GetAppliedGPOListA GetAppliedGPOListW GetDefaultUserProfileDirectoryA GetDefaultUserProfileDirectoryW GetGPOListA GetGPOListW GetNextFgPolicyRefreshInfo GetPreviousFgPolicyRefreshInfo GetProfileType GetProfilesDirectoryA GetProfilesDirectoryW GetUserProfileDirectoryA GetUserProfileDirectoryW HasPolicyForegroundProcessingCompleted LeaveCriticalPolicySection LoadProfileExtender LoadUserProfileA LoadUserProfileW ProcessGroupPolicyCompleted ProcessGroupPolicyCompletedEx RefreshPolicy RefreshPolicyEx RegisterGPNotification RsopAccessCheckByType RsopFileAccessCheck RsopLoggingEnabled RsopResetPolicySettingStatus RsopSetPolicySettingStatus UnloadProfileExtender UnloadUserProfile UnregisterGPNotification WaitForMachinePolicyForegroundProcessing WaitForUserPolicyForegroundProcessing

Name

.text

Size

966KB

Virtual Size

965KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/17

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.extra

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

userenv.dll

kernel32

msvcrt

ws2_32

generic